9:15 a.m.
Hi, I have an IPA culster with 4 servers with DNS integrated.
SSSD client nativetely balances the load on 4 servers and that is OK.
But what if I need to do curl calls to API end-point. Is there some mechanism to perform
discovery and load balance?
thank you
10:13 a.m.
Maybe you can achieve your goal using DNS. Define an address (say
api.your.domain) and configure DNS to resolve it in your 4 servers IP
addresses. Then point your API consumer to that address.
HTH,
gc
Il 26/06/2020 16:15, Daniel PC via FreeIPA-users ha scritto:
Hi, I have an IPA culster with 4 servers with DNS integrated.
SSSD client nativetely balances the load on 4 servers and that is OK.
But what if I need to do curl calls to API end-point. Is there some mechanism to perform
discovery and load balance?
thank you
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
1:03 p.m.
Giulio Casella via FreeIPA-users wrote:
Maybe you can achieve your goal using DNS. Define an address (say
api.your.domain) and configure DNS to resolve it in your 4 servers IP
addresses. Then point your API consumer to that address.
It won't work for a number of TLS and Kerberos since names are so
important but it requires HTTP referer as well to mitigate XSS attacks.
What are the curl commands doing? Is it something you could use the IPA
python code for instead? It will retry hosts that are down and fall back
to SRV records.
rob
HTH,
gc
Il 26/06/2020 16:15, Daniel PC via FreeIPA-users ha scritto:
> Hi, I have an IPA culster with 4 servers with DNS integrated.
>
> SSSD client nativetely balances the load on 4 servers and that is OK.
>
> But what if I need to do curl calls to API end-point. Is there some mechanism to
perform discovery and load balance?
>
> thank you
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
2:05 p.m.
curl commands are used to enrollment of new systems on IPA.
I'm thinking to use as endpoint something like:
_ldap._tcp.mydomain.local
when I do:
host -t SRV _ldap._tcp.mydomain.local
I receive as output the list of IPA systems.
what do you think?
Thank you
2:52 p.m.
Daniel PC via FreeIPA-users wrote:
curl commands are used to enrollment of new systems on IPA.
I'm thinking to use as endpoint something like:
_ldap._tcp.mydomain.local
when I do:
host -t SRV _ldap._tcp.mydomain.local
I receive as output the list of IPA systems.
what do you think?
It's in the TODO list for curl:
https://curl.haxx.se/docs/todo.html#SRV_and_URI_DNS_records
So it's a good idea but won't work yet without doing it yourself as far
as I can see.
rob
10:53 a.m.
Unfortunately curl doesn't make SRV calls. the only solution I see is to set up a
round-robin DNS with type A records but after setting it doesn't balance me between
nodes, it always answers the same.
Any help on this?
4:05 p.m.
Daniel PC via FreeIPA-users wrote:
Unfortunately curl doesn't make SRV calls. the only solution I
see is to set up a round-robin DNS with type A records but after setting it doesn't
balance me between nodes, it always answers the same.
Any help on this?
Even if you got the round-robin to work, as I explained before Kerberos
and TLS are name-sensitive so if you ask for foo and bar answers things
aren't going to work out-of-the-box. There are workarounds but it'd be
manual work you'd have to put in every time an IPA server is created or
removed. And it will still be blocked by the HTTP referer XSS check.
rob
1:51 a.m.
At this point what do you suggest i use? My options are over. curl does not implement SRV.
DNS round-robin has problems. Are there any solutions left? You mentioned python. How
could i use it?
thank you
8:41 a.m.
Daniel PC via FreeIPA-users wrote:
At this point what do you suggest i use? My options are over. curl
does not implement SRV. DNS round-robin has problems. Are there any solutions left? You
mentioned python. How could i use it?
Let's start with what it is you are trying to do.
rob
10:10 a.m.
In a linux shell you can try:
IPASERVER=$(python << EOF
import dns.resolver
for rdata in dns.resolver.query('_ldap._tcp.your.ipa.domain', 'SRV'):
print rdata.target
break
EOF
)
You should obtain one of your ipa domain controller; not really round
robin, but in a pseudo random fashion. Then use $IPASERVER as a
parameter for curl.
HTH,
gc
On 30/06/2020 08:51, Daniel PC via FreeIPA-users wrote:
At this point what do you suggest i use? My options are over. curl
does not implement SRV. DNS round-robin has problems. Are there any solutions left? You
mentioned python. How could i use it?
thank you
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
1394
days inactive
1398
days old
freeipa-users@lists.fedorahosted.org
10 comments
3 participants
participants (3)
-
Daniel PC -
Giulio Casella -
Rob Crittenden